Fix error handling in X509_chain_up_ref master
authorBernd Edlinger <bernd.edlinger@hotmail.de>
Fri, 16 Aug 2019 13:18:51 +0000 (15:18 +0200)
committerBernd Edlinger <bernd.edlinger@hotmail.de>
Sat, 17 Aug 2019 14:49:46 +0000 (16:49 +0200)
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9614)

crypto/x509/x509_cmp.c

index 284ca54..d7bbbc1 100644 (file)
@@ -450,9 +450,17 @@ STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain)
     STACK_OF(X509) *ret;
     int i;
     ret = sk_X509_dup(chain);
+    if (ret == NULL)
+        return NULL;
     for (i = 0; i < sk_X509_num(ret); i++) {
         X509 *x = sk_X509_value(ret, i);
-        X509_up_ref(x);
+        if (!X509_up_ref(x))
+            goto err;
     }
     return ret;
+ err:
+    while (i-- > 0)
+        X509_free (sk_X509_value(ret, i));
+    sk_X509_free(ret);
+    return NULL;
 }